Archive | Cryptography
Encrypt your laptop — the whys and hows
The Intercept: Encrypting Your Laptop Like You Mean It »
Government and encryption: The split key approach
Governments are trying different approaches to circumvent encryption. While the British can send you to jail if you don’t give up your password, the US administration (restricted by the fifth amendment) is floating an alternative concept: the split key.
The idea is to gain access to smart phones and computers trough a unique “master key” for each unit, that is split in two — where the tech company in question has one part and the government has the other. By a court order the tech company could be ordered to hand over their part of the key to the government.
Keeping track of every new or used smartphone, tablet, laptop an PC and who is using it — pairing it with half a unique key — for sure will create a lot of new jobs in the public sector. And it will become a mess.
One central issue is how not to compromise user security. The Washington Post writes…
But some technologists still see difficulties. The technique requires a complex set of separate boxes or systems to carry the keys, recombine them and destroy the new key once it has been used. “Get any part of that wrong,” said Johns Hopkins University cryptologist Matthew Green, “and all your guarantees go out the window.”
How can we even trust that tech companies will not collaborate with the government behind their customers back? It has happened before. Would you bet on it never happening again? Ever?
And, is it necessary?
Neither Bitkower nor FBI Director James B. Comey, who also has been vocal about the problem, has been able to cite a case in which locked data thwarted a prosecution. But they have offered examples of how the data are crucial to convicting a person.
Should we really treat all citizens as potential criminals or terrorists? Will not the uncertainty about security breaches and fuck ups overshadow possible “benefits”? Do people have any reason to trust government any more than the government trusts them?
Somehow, this is no longer a question of security, law enforcement or even intelligence activities. It has become a matter of principle. The government demands to have access to all citizens all telecommunications and computers.
This is a red line that should never be crossed. Because if we do, it will be irreversible.
WP: As encryption spreads, U.S. grapples with clash between privacy, security »
/ HAX
Europol lobbying against encryption
The law enforcement lobbying campaign against encryption continues. Today it’s Europols director Rob Wainwright who is trying to make a case against privacy on BBC 5.
Europol chief warns on computer encryption »
This is the same man who told the European Parliament that Europol is not going to investigate the alleged NSA hacking of the SWIFT (international bank transfer) system. The excuse he gave was not that Europol didn’t know about it, because it did. Very much so. It was that there had been no formal complaint from any member state.
So the EU police agency happily turned a blind eye to ongoing crime — when possibly committed by the NSA.
That will give you an indication about where the Europols sympathies lies. That is, not with the general public.
/ HAX
Hot air from Washington on encryption (and a rather chaotic summit on extremism)
US president Barack Obama has been expected to present his policy on encryption for some time now. And, finally, he did. Kind of. Or not.
“I think the only concern is… our law enforcement is expected to stop every plot. Every attack. Any bomb on a plane. The first time that attack takes place, where it turns out we had a lead and couldn’t follow up on it, the public’s going to demand answers. This is a public conversation that we should be having,” Obama said in a Friday interview with Re/Code. “I lean probably further in the direction of strong encryption than some do inside law enforcement. But I am sympathetic to law enforcement, because I know the kind of pressure they’re under to keep us safe. And it’s not as black and white as it’s sometimes portrayed. Now, in fairness, I think those in favor of air tight encryption also want to be protected from terrorists.”
See the interview at Re/Code here. »
Another presidential quote…
“One of the interesting things about being in this job, is that it does give you a bird’s-eye view. You are smack dab in the middle of these tensions that exist. But, there are times where folks who see this through a civil liberties or privacy lens reject that there’s any tradeoffs involved. And, in fact, there are. And you’ve got to own the fact that it may be that we want to value privacy and civil liberties far more than we do the safety issues. But we can’t pretend that there are no tradeoffs whatsoever.”
The man is clearly stalling.
So what about the international security summit in Washington this week? Well, it seems to have changed in nature towards something more of a high level conference on extremism — to smooth over the fact that President Obama didn’t go to Paris after the terroris attacks. The BBC reports…
Still the planning seems a bit chaotic. Invitations to the summit went out to foreign embassies on 29 January, a State Department official told me.
At an event at the Atlantic Council in Washington on the following day, European officials said they still weren’t sure which minister would be appropriate to send to Washington.
Even those who are passionate about the goals of the summit – combating violent extremism – wonder about the optics – a term the Washington political class use to describe how an event is perceived.
In the end, it all boiled down to being a back drop for president Obama to deliver yet another very Kum Ba Yah speech.
The trip to Washington did however provide an opportunity for a plethora of meetings between EU and US politicians and security officials. Which is probably where all the interesting stuff went on. The stuff the general public is not supposed to know about — yet.
/ HAX
Links:
• The Obama interview at Re/Code »
• Ars Technica: Obama hedges position on encryption. It’s good. It’s bad. »
• Slate: Tech Whiplash: Obama Endorses, Then Undermines, Encryption »
• BBC: Extremism summit: Too little, too late, too chaotic? »
• White House: Remarks by the President in Closing of the Summit on Countering Violent Extremism »
• Breitbart: Extremists Attending Obama’s ‘Countering Extremism’ Summit »
The EU and a global ban on encryption
By HAX on February 15, 2015 in Cryptography, Data Protection, Democracy, EU, Global Politics, Internet, Privacy, surveillance, US
Will encryption become illegal? Will governments demand “golden keys” to commonly used encryption? If governments will go after encryption, will they make a difference between encryption used in Internet “base traffic” and encryption used by people to protect their mail and hard drives? What about apps? Nobody seems to know. All we do know is that governments would like to have access to all our communications.
Even if they have tried to keep it under wraps EU member states would like to circumvent encryption. In a leaked dokument from the informal meeting with EU justice and home affairs ministers the other week (PDF), we have it in writing…
“Since the Snowden revelations, internet and telecommunications companies have started to use often de-centralized encryption which increasingly makes lawful interception by the relevant national authorities technically difficult or even impossible. The Commission should be invited to explore rules obliging internet and telecommunications companies operating in the EU to provide under certain conditions as set out in the relevant national laws and in full compliance with fundamental rights access of the relevant national authorities to communications (i.e. share encryption keys). “
So, we pretty much know what the EU stance will be at the Global Security Summit, in the US nest week.
Interestingly, the European Parliament seems to have an opposite position. In its resolution on mass surveillance of March 2014, the Parliament states that…
[The EP] calls on the Commission to […] ensure a high level of security of telecommunication networks and services, including by way of requiring state-of-the-art end-to-end encryption of communications.
[The EP] calls for the EU to take the lead in […] rerouting of Internet traffic or full end-to-end encryption of all Internet traffic so as to avoid the current risks associated with unnecessary routing of traffic through the territory of countries that do not meet basic standards on fundamental rights, data protection and privacy.
[The EP] calls for the promotion of … encrypting communication in general, including email and SMS communication.
Apparently the European Parliament takes a very different stand, compared to EU member states.
And the Council of Europe (a parlament-like assembly with representatives from most European countries, including non-EU states) makes its position clear in a report…
“The assembly is deeply worried about threats to internet security by the practice of certain intelligence agencies […] of seeking out systematically, using and even creating “back doors” […] which could easily be exploited also by terrorists and cyber-terrorists or other criminals. […] The creation of “back doors” or any other techniques to weaken or circumvent security measures or exploit their existing weaknesses should be strictly prohibited.”
Again, this is a clear standpoint, the very opposite to that of EU member states.
To continue, we have a study from the European Parliament’s Science and Technology Options Assessment unit stating…
“The only way for citizens to counteract surveillance and prevent breach of privacy consists in guaranteeing uncorrupted end-to-end encryption of content and transport channel in all their communications.”
“The EU should invest in resilient open source implementations of different encryption specifications that can be verified and validated for correctness … providing users with unbreakable cryptographic protection. … The EU should invest in making users aware […] how [they] can reduce their digital footprint by following behavioural rules and applying encryption and anonymising principles.”
To put it simply: EU member states would love to have a ban on encryption or a “golden key”. Other relevant European institutions take an opposite standpoint — valuing and defending encryption.
But it will be the EU member states (and the EU Counter-Terrorism Coordinator) who are present at the Global Security Summit in Washington the coming week. And they will try to make their position global policy.
There is a way to get an encryption ban / golden key out of the summits agenda. That is to make this a public issue, to get the media involved and for people to speak out against this madness.
What we do right now will define our future.
/ HAX
Links:
• Not this again! Europe mustn’t backtrack on its support of encryption and rejection of surveillance »
• Next Week, World Leaders Will Meet to Talk About How Much They Hate Encryption »
• Council of the European Union (EU member states) PDF »
• Council of Europe (PDF) »
• UK Surveillance Consultation Suggests It Is End-Point Security, Not Encryption, That Cameron Wants To Subvert »
• In two weeks time, world leaders may decide to undermine encryption »
In defence of encryption
Above, German Pirate Party MEP Julia Reda in the European Parliament this week.
Links:
Next Week, World Leaders Will Meet to Talk About How Much They Hate Encryption »
In two weeks time, world leaders may decide to undermine encryption
By HAX on February 5, 2015 in Big Brother, Big Government, Cryptography, EU, Privacy, surveillance, Uncategorized, US, War on Terror
There are telltale signs that the US administration will move against encryption. The latest comes from Bob Litt, the General Counsel for the Office of the US Director of National Intelligence (ODNI).
In a speech this week he echoed the demand that government should be allowed access to all our information. Among other things, he touched on the idea of a magical golden key.
I’m not a cryptographer, but I am an optimist: I believe that if our businesses and academics put their mind to it, they will find a solution that does not compromise the integrity of encryption technology but that enables both encryption to protect privacy and decryption under lawful authority to protect national security.
Even if this is not a ban on encryption, it is very serious. Mike Masnick at Techdirt explains…
I’m not sure how many times in how many different ways this needs to be explained, but what they’re asking for is a fantasy. You cannot put a backdoor in encryption and create a magic rule that says “only the government can use this in lawful situations.” That’s just not how it works. At all. The very idea of decryption by a third party “compromises the integrity of the encryption technology,” almost by definition.
But I’m not sure this will be considered as a valid argument by our ignorant politicians.
It would make little sense for the US to go for a “magical golden key” on its own. Likely other members of the NSA Five Eyes group (UK, Canada, Australia and New Zeeland) will do the same.
And the EU? Europe normally follows the US in these matters. There will be an Global Security Summit in Washington later this month. And there are reasons to believe that also politicians in most EU member states would like to give their authorities the ability to circumvent encryption.
As EU member state ministers for justice and home affairs made their last meeting (in Riga) an informal one, this topic might very well have been up for discussion. (But the public is not allowed to know exactly what went on.) This is exactly what you might expect — and exactly the kind of thing the Council would keep under wraps, to avoid debate and protests until it’s too late. And the timing is just right.
The way the world is right now (Ukraine, IS and potential monetary crises) it should be no problem for world leaders to package the whole thing as “emergency legislation”.
The European Parliament will object, no doubt. But it will be sidestepped. All EU member states have to do is to agree to make this national legislation in all (or most) member states.
As a matter of fact, the EU has no formal competence when it comes to national security matters. So it will have to be a multilateral arrangement.
All the European Parliament can do is to try to protect human and civil rights in a wider sense. But that will probably not go beyond a sharply formulated resolution.
The matter can be sent to the European Court of Justice (for breach of the EU Charter of Fundamental Rights) or the European Court of Human Rights (upholding the European Convention on Human Rights). But in both cases a court process may drag out for years.
In this matter, politicians can do almost as they want. And they will not fail to make use of current world events as an excuse. (Never waste a good crisis.) The only thing that might stop them is general outcry — on a massive scale.
Soon we will know. All eyes on the Global Security Summit in the US on February 18.
/ HAX
Obama to make policy decision on encryption
The New York Times reports…
“Decisions remain to be made, for example, on whether the government will accede to the review group’s insistence that the intelligence agencies support stronger encryption of data to protect against hacking — at a moment when the F.B.I. and many intelligence officials are protesting that new encryption technologies used by Apple for its iPhones and other firms are making it all but impossible to decode the communications of suspected criminals or terrorists. Mr. Obama is expected to make decisions on those issues in the coming weeks.”
AJE: The Jason Moon interview
By HAX on February 1, 2015 in Big Brother, Cryptography, Democracy, Hacktivism, Internet, NSA & Snowden, surveillance, War on Terror
Here is a sobering interview, made by Al Jazeera English with hacker Jason Moon.
Among other things he talks about the new imbalance between data mining and old fashion intelligence work–making us all less secure.